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IN THE CLAIMS 

This listing of claims will replace all prior versions and listings of claims 
in the application: 

1 . (Currently amended) A computerized method for recognizing and 
flagging a data item used by one or more application programs as falling within the scope 
of a rule but anomalous when compared with other data items falling within the scope of 
the rule, the method comprising: 

determining a collection to which the data item belongs as defined by the 

rule; 

calculating statistics for the other data items in the collection; 

identifying whether the data item is an anomalous data item based on the 
statistical calculations; and 

flagging the data item as an anomalous data item if the data item is 
identified as an anomalous data item. 

2. (Original) The method of claim 1 wherein calculating comprises 
calculating a mean data item size and standard deviation for the other data items in the 
collection. 

3. (Original) The method of claim 1 wherein calculating comprises 
calculating a mean interval between data items and standard deviation for the other data 
items in the collection. 

4. (Original) The method of claim 1 wherein calculating comprises 
calculating a mean data item arrival time and standard deviation for the other data items 
in the collection. 
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5. (Original) The method of claim 1 wherein calculating comprises: 
calculating a presence or absence of keywords for the other data items in 

the collection; and 

identifying whether the data item is an anomalous data item based on the 
presence or absence of keywords. 

6. (Original) The method of claim 1 wherein calculating statistics for the 
other data items in the collection is performed in real time. 

7. (Original) The method of claim 1 wherein the step of calculating 
statistics for the other data items in the collection is performed periodically. 

8. (Original) The method of claim 1 wherein identifying comprises 
determining whether the data items falls outside a number of standard deviations from the 
statistical calculations. 

9. (Original) The method of claim 8 comprising setting the number of 
standard deviations to a value set by a user. 

10. (Original) Computer readable media comprising program code, the 
program code instructing a programmable computer to execute a method for recognizing 
and flagging a data item used by one or more application programs as falling within the 
scope of a rule but anomalous when compared with other data items falling within the 
scope of the rule, the method comprising: 

determining a collection to which the data item belongs as defined the 

rule; 

calculating statistics for the other data items in the collection; 
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identifying whether the data item is an anomalous data item based on the 
statistical calculations; and 

flagging the data item as an anomalous data item if the data item is 
identified as an anomalous data item. 

1 1 . (Previously amended) The computer readable media of claim 1 0 
comprising a method for recognizing and flagging a data item used by one or more 
application programs as falling within the scope of a rule but anomalous when compared 
with other data items falling within the scope of the rule wherein calculating comprises 
calculating a mean data item size and standard deviation for the other data items in the 
collection. 

12. (Original) The computer readable media of claim 10 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein calculating comprises calculating a 
mean interval between data items and standard deviation for the other data items in the 
collection. 

13. (Original) The computer readable media of claim 10 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein calculating comprises calculating a 
mean data item arrival time and standard deviation for the other data items in the 
collection . 
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14. (Original) The computer readable media of claim 10 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein calculating comprises: 

calculating a presence or absence of keywords for other data items in the 

collection; and 

identifying whether the data item is an anomalous data item based on the 
presence or absence of keywords. 

15. (Original) The computer readable media of claim 10 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein calculating statistics for other data 
items in the collection is performed in real time. 

16. (Original) The computer readable media of claim 10 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein calculating statistics for other data 
items in the collection is performed periodically. 

17. (Original) The computer readable media of claim 10 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein identifying comprises determining 
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whether the data item falls outside a number of standard deviations from the statistical 
calculations. 

1 8. (Original) The computer readable media of claim 17 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule comprising setting the number of standard 
deviations to a value set by a user. 

1 9. (New) A method for recognizing and flagging a data item used by 
one or more application programs as falling within the scope of a rule but anomalous 
when compared with other data items falling within the scope of the rule, them method 
comprising: 

retrieving a user preference profile; 

determining a collection to which the data item belongs as defined by the 

rule; 

calculating statistics for the other data items in the collection; 

identifying whether the data item is an anomalous data item based on the 
statistical calculations; 

flagging the data item as an anomalous data item if the data item is identified 
as an anomalous data item; and 

determining an action to take for the flagged data item based upon the user 
preference profile retrieved. 
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